News for hackers. Stuff that matters.
Re:Salesforce fires red team staffers who gave Defcon talk by tlogan on Wednesday August 09, 2017 @06:57PM (#14974538)
In a large corporation I worked for a long time, if EVP fires somebody on the spot it means that EVP is next to go. I assume this will be the case for Salesforce.
Re:Salesforce fires red team staffers who gave Defcon talk by LateChannels on Wednesday August 09, 2017 @07:07PM (#14974614)
On the spot, At defcon, 30k people. Anyone at Salesforce wanna talk about what's going on? Make a throwaway, use opsec. What are your opinions on this? What is your opinion of Jim as your leader?
Re:Salesforce fires red team staffers who gave Defcon talk by throwaway795463 on Thursday August 10, 2017 @03:18AM (#14977202)
Throwaway for obvious reasons.

Incredibly bad leader. Ask away.

Re:Salesforce fires red team staffers who gave Defcon talk by provost on Thursday August 10, 2017 @03:55AM (#14977394)
No questions from me, but I've met Josh and the rest of the redteam. I hope they are doing well. Lots of good folks in salesforce security =)
Re:Salesforce fires red team staffers who gave Defcon talk by aedron on Thursday August 10, 2017 @04:51AM (#14977758)
Okay, umm... Why is he an incredibly bad leader?
Re:Salesforce fires red team staffers who gave Defcon talk by Quarrelsome on Thursday August 10, 2017 @05:38AM (#14978025)
what are this "leader"'s justifications for preventing the talks and for preventing the open sourcing of this software? Is it liability or competitive advantage based?
Re:Salesforce fires red team staffers who gave Defcon talk by quantumhobbit on Thursday August 10, 2017 @04:27AM (#14977587)
Were there any consequences for the leader? If not, it sounds like those above him are just as bad.
Re:Salesforce fires red team staffers who gave Defcon talk by mygo on Thursday August 10, 2017 @11:41PM (#14986431)
How do we even know you work there?
Re:Salesforce fires red team staffers who gave Defcon talk by placeybordeaux on Thursday August 10, 2017 @02:41PM (#14982782)
why are you still there?
Re:Salesforce fires red team staffers who gave Defcon talk by whipoodle on Wednesday August 09, 2017 @08:08PM (#14975016)
Wait, what's the reason for that rule? Sounds interesting.
Re:Salesforce fires red team staffers who gave Defcon talk by elgenie on Wednesday August 09, 2017 @09:17PM (#14975412)
Firing someone on the spot in a public setting is either a drastic overreaction (and why that's fireable is obvious), or a response to a complete blindsiding … at a level at which the job is to not get blindsided.
Re:Salesforce fires red team staffers who gave Defcon talk by throwanem on Wednesday August 09, 2017 @11:31PM (#14976105)
Either way, it's a complete PR catastrophe, at a level at which the job is not to do those.
Re:Salesforce fires red team staffers who gave Defcon talk by schwarrrtz on Thursday August 10, 2017 @02:45AM (#14977073)
It's also a complete HR catastrophe. How could anyone feel comfortable in their position, knowing they could be fired at any moment, publicly and without warning? Terrorizing your employees is completely unacceptable as a manager.

Edit: I guess I don't have much experience with HR at large companies - I use the term to refer to aspects of management related to maintaining employee wellbeing, workplace culture etc.

Re:Salesforce fires red team staffers who gave Defcon talk by throwanem on Thursday August 10, 2017 @02:58AM (#14977119)
HR doesn't care about that! Not unless it's actionable. Good way to lose your star contributors, sure, but past a certain basic point retention isn't really part of HR's role.
Re:Salesforce fires red team staffers who gave Defcon talk by beobab on Thursday August 10, 2017 @03:26AM (#14977238)
"Retention isn't part of HR's role"

Really? I've always seen HR as a sort of "union for un-unionised employees". They help you get stuff out of the business, and help the business get the most out of you.

Perhaps I've only encountered the good kind of HR.

Re:Salesforce fires red team staffers who gave Defcon talk by KineticLensman on Thursday August 10, 2017 @04:04AM (#14977446)
A significant aspect of HR (at least in the UK) is protecting the company from its 'resources', and ensuring that the company has a robust (i.e. legally defensible) paper trail when disputes arise. E.g a process for putting people on an 'improvement plan' in response to poor behaviours / performance, and which can ultimately lead to dismissal.

Back in the day, the term 'anti-personnel department' was often used.

And don't get me started on the use of the term 'human resources'

[Edit] - more detail. I'm a techie but have occasionally had line management (in addition to tech lead) responsibilities. The first time I took on these duties, I had to do the relevant HR training and was amazed at the attitude: a little bit of 'duty-of-care' and a lot of 'follow-this-process-to-make-sure-the-law-is-on-our-side'

Re:Salesforce fires red team staffers who gave Defcon talk by arethuza on Thursday August 10, 2017 @05:59AM (#14978125)
My experiences of UK large company HR departments was basically that they were the hit squad - if they were in the building then you knew someone was in major trouble.

I had an interesting experience a couple of years back when everyone in our office was called to a surprise meeting with HR except me.... I had already resigned, everyone else got the bullet in that caring way that HR departments are famous for.

Re:Salesforce fires red team staffers who gave Defcon talk by tlavoie on Friday August 11, 2017 @02:41PM (#14992908)
A company I worked at did something similar; those who were being kept were told to go somewhere else, not to go to that meeting. Those that were still around were herded into the classroom, to be met by the HR head and a hired goon of a security guard. The entire office was being closed, but the way it was done was more hurtful to those folks than the basic business decision.
Re:Salesforce fires red team staffers who gave Defcon talk by hd4 on Thursday August 10, 2017 @04:54AM (#14977769)
Can confirm as a programmer in UK. I hit this wall recently when asking for extended leave to deal with a personal crisis. The colluded response from HR/the business was to give me notice.
Re:Salesforce fires red team staffers who gave Defcon talk by moomin on Thursday August 10, 2017 @03:46AM (#14977353)
Take it from someone whose partner works in HR: they are not your friend. They may be nice people, they may try to help, but their _job_ is to protect the company's interests. Each time you talk to them about conflict, you're taking a bet your interests and theirs align.

In other news, for a bunch of smart people, engineers are spectacularly underunionized.

Re:Salesforce fires red team staffers who gave Defcon talk by Angostura on Thursday August 10, 2017 @05:05AM (#14977829)
They are however, definitely interested in retention. They have a keen understanding of the total cost of finding and onboarding a new employee. If a particular executive is putting that in jeopardy then a good HR department will take note.
Re:Salesforce fires red team staffers who gave Defcon talk by toyg on Thursday August 10, 2017 @05:25AM (#14977950)
> They have a keen understanding of the total cost of finding and onboarding a new employee.

Because they will be involved in recruiting, they will also have a keen understanding of how much that increases their workload, which is otherwise pretty flimsy in a lot of cases. The more churn, the more they can justify their headcount.

Re:Salesforce fires red team staffers who gave Defcon talk by moomin on Thursday August 10, 2017 @06:55AM (#14978400)
They definitely are, but in a circumstance like this the most _urgent_ problem they've got is a bunch of ex-employees with a legal action brewing. Implicitly admitting liability without a quid-pro-quo isn't going to happen.

Which isn't to say HR won't want him gone. Just not yet.

Re:Salesforce fires red team staffers who gave Defcon talk by izacus on Thursday August 10, 2017 @04:24AM (#14977566)
Well yes, but companys interest in this case is not to have a PR fail at their hands.
Re:Salesforce fires red team staffers who gave Defcon talk by toyg on Thursday August 10, 2017 @04:22AM (#14977558)
> They help you get stuff out of the business

Nope; they help the business get the most out of you without getting sued. That's the alpha and omega of HR.

Their obligations are to the company, not to you. When they answer your questions, they do it so you can't claim later on that the company didn't tell you such and such or that the procedure XYZ was unclear, and sue them. They are nice so that you won't see the company as adversarial and sue them. And so on and so forth.

Re:Salesforce fires red team staffers who gave Defcon talk by marvin on Thursday August 10, 2017 @05:15AM (#14977897)
At some places, they have one branch of "good cop" HR that cuddles the employees, hands out candy and attempt to boost morale, and one "bad cop" branch that does all the dirty work of protecting the company from liability and attempting to squeeze out as many hours as possible while keeping compensation and human costs to a minimum.
Re:Salesforce fires red team staffers who gave Defcon talk by snarfy on Thursday August 10, 2017 @07:02AM (#14978444)
They aren't your friends. They protect the company first. Definitely think twice before going to HR for anything not related to the normal benefits/vacation type issues. If you have an issue with another employee, you may very well be the problem that gets eliminated, not the other employee.
Re:Salesforce fires red team staffers who gave Defcon talk by defined on Thursday August 10, 2017 @03:52AM (#14977379)
Many people, myself included, feel that HR is almost totally on the side of the company and don't represent employee interests effectively (if at all).
Re:Salesforce fires red team staffers who gave Defcon talk by coldtea on Thursday August 10, 2017 @06:28AM (#14978276)
Catastrophe?

I doubt it will make even a dent in Salesforce's profits or that anybody of their clients will even blink about it.

As for their PR, that's paid for (and customers might even like the drastic action).

Except if you mean PR to prospective security hacker hires.

Re:Salesforce fires red team staffers who gave Defcon talk by _ph_ on Thursday August 10, 2017 @06:56AM (#14978412)
Having a major disruption in your security department can mean an upcoming disaster for a company offering cloud based services. From what this sounds, they not only got rid of 2 very competent employees, the manager doesn't seem to have acted especially brilliant, and they might have discouraged competent security people from applying at the company. What could possibly go wrong with this?
Re:Salesforce fires red team staffers who gave Defcon talk by gboudrias on Thursday August 10, 2017 @02:26AM (#14976990)
How does one even make this mistake? There seems to be nothing strategic about this...
Re:Salesforce fires red team staffers who gave Defcon talk by morgante on Thursday August 10, 2017 @02:51AM (#14977100)
People aren't fully strategic 100% of the time. When clouded by emotion, suboptimal decisions can look strategic. (Ex. establishing/asserting their authority.)
Re:Salesforce fires red team staffers who gave Defcon talk by whipoodle on Thursday August 10, 2017 @01:34AM (#14976743)
Oh, gotcha. Thanks.
Re:Salesforce fires red team staffers who gave Defcon talk by spydum on Wednesday August 09, 2017 @08:20PM (#14975083)
Executives who make hasty hot headed decisions are not the guys you want steering the ship, regardless of what the popular caricatures you see on TV.
Re:Salesforce fires red team staffers who gave Defcon talk by bsder on Wednesday August 09, 2017 @08:45PM (#14975247)
Well, in this case:

1) The PR backlash is going to be gigantic.

2) If you fire someone on the spot (I have), you'd better have a damn good reason (I did--repository sabotage) as the company is now going to have to pay money to defend/payoff this.

3) Suddenly firing important people disrupts daily business functions for weeks or months.

4) Unless you think they are going to actively sabotage something, you can wait until they get home to reprimand or fire people.

All told, some manager is getting thrown under the bus for this.

Re:Salesforce fires red team staffers who gave Defcon talk by paulcole on Wednesday August 09, 2017 @11:29PM (#14976091)
> The PR backlash is going to be gigantic.

The Google thing was gigantic. This is a blip.

Re:Salesforce fires red team staffers who gave Defcon talk by fencepost on Thursday August 10, 2017 @01:09AM (#14976613)
The Google thing is a medium splash in a big pond. This is a small splash, but arguably in a much smaller and more concentrated pond. Within the community of red teams and DEFCON regulars I wouldn't be surprised if this is much better known than the (now) ex Googler is within the more general tech community.
Re:Salesforce fires red team staffers who gave Defcon talk by fl0wenol on Thursday August 10, 2017 @02:31AM (#14977010)
What Google thing?
Re:Salesforce fires red team staffers who gave Defcon talk by inopinatus on Thursday August 10, 2017 @05:43AM (#14978051)
An internal memo with astonishingly poor typography was leaked. Since Google sell a word processor and are a font vendor this made them look bad. So he was fired.

(I'm only half joking. People don't talk about how poor the layout of that document was, but it was my first and lasting impression)

Re:Salesforce fires red team staffers who gave Defcon talk by lugg on Thursday August 10, 2017 @06:40AM (#14978326)
Surely there is more context to that story.

It's unbelievable that it was only the memo. And quite likely just the last straw.

I can easily imagine someone that produces poor quality once publically probably did so many times privately and likely more of a symptom of underlying inadequacy than the actual reason for firing.

But you know, headlines..

And yes, have no previous experience or knowledge about this so sorry if I'm armchairing a bit.

Re:Salesforce fires red team staffers who gave Defcon talk by VHRanger on Thursday August 10, 2017 @07:07AM (#14978461)
No, it was just the memo.

Larry Summers (a leading economist with often controversial opinions) got fired from his position as the president of harvard for effectively making the same point [1] except, you know, well argued unlike in the Google manifesto.

If Larry Summers gets fired for that, a random engineer is definitely getting the boot.

[1] http://www.harvard.edu/president/speeches/summers_2005/nber....

Re:Salesforce fires red team staffers who gave Defcon talk by TeMPOraL on Thursday August 10, 2017 @07:29AM (#14978585)
Honestly, relative to the usual discussions on the topic (including discussions about the Google memo), the memo was refreshingly well-argued, coherent and polite.
Re:Salesforce fires red team staffers who gave Defcon talk by sudosteph on Thursday August 10, 2017 @01:00PM (#14981706)
That's just like, your opinion man.

Everyone agrees it was polite, but well-argued and coherent is where not everyone does agree.

I've seen people with advanced degrees host debates where they legitimately advocated creationism as the truth against evolutionary biologists with equally advanced degrees. They were polite, and their supporters would say well-argued and coherent. But anyone who knows anything about the topic would see that the creationists weren't actually adding to the discussion or making strong points at all. Those creationist debates are always unsatisfying and exhausting to listen to, and after a while, that schtick becomes old and non-creationists stop engaging because it's just boring. But creationists will attend and be excited every time because having a debate against a real scientist legitimizes them.

That's how this memo thing felt. Nothing new was added to the discussion (at least not to those of us who have had this discussion before) and it just seemed like an opportunity that some less savory folks jumped on to promote some out-dated views (and more importantly, for mainstream media to jump on to paint all of tech as a place where those views are the norm. That story sells despite how wrong it is).

FWIW, I do hate impoliteness though. I understand why people felt defensive for the author after watching the internet freak the hell out (in rude or dismissive ways) about the memo which was not impolite in itself.

Re:Salesforce fires red team staffers who gave Defcon talk by TeMPOraL on Thursday August 10, 2017 @01:39PM (#14982130)
Well yes, that's my opinion :). I found the memo coherent, in the sense that it was well-structured and followed consistent reasoning, and well-argued, in the sense that it linked to supporting research and reasoned mostly correctly from it. It doesn't mean everything there was 100% correct, but almost no one is; it still was a quality entry to the intellectual debate.

At the risk of perpetuating the disagreement, IMO if anything is similar to the creationinst debaters, it's the voices against the memo.

Going through the few recent HN discussions on the topic, I found that on the one side, you had people (including an actual scientist in the domain) telling that the memo basically got the science (even if not ultimate conclusions) right, as supported by _even more_ research people linked to, vs. the other side saying he presents "outdated" views of "biological determinism", etc., with no counter to the research cited by the memo itself (not to mention others) - just unsubstantiated accusations and dismissals.

Re:Salesforce fires red team staffers who gave Defcon talk by tajen on Thursday August 10, 2017 @06:18PM (#14984873)
More than 5 doctors confirmed the memo was consistent with science and his text referenced appropriate sources, as common with any paper. It's incredible that non-medical people can override science with their belief. It's Galileo all over again, fired because one shall not contradict [place godly entity here].
Re:Salesforce fires red team staffers who gave Defcon talk by inopinatus on Thursday August 10, 2017 @07:09PM (#14985214)
The paper went much further than presenting a summary of mashed up research from a variety of fields that investigate sex & gender variations. For that, all you need is some reprints of Nature and Scientific American.

Instead it wanted to connect that research to a) company policy and b) American-specific political divides. And to do that required a battery of assumptions regarding intention, merit, aptitude, worth, values.

That's where the wheels came off and everyone started projecting their own ideological interpretations, and you've been arguing past each other ever since.

Re:Salesforce fires red team staffers who gave Defcon talk by JshWright on Thursday August 10, 2017 @07:54AM (#14978738)
The memo also put forth a position that women were, on average, biologically inferior to men at engineering roles.
Re:Salesforce fires red team staffers who gave Defcon talk by TOMDM on Thursday August 10, 2017 @05:24AM (#14977945)
In the off chance you're not making a point/being funny, they're most likely referring to the diversity manifesto
Re:Salesforce fires red team staffers who gave Defcon talk by fl0wenol on Wednesday August 16, 2017 @02:16AM (#15025312)
Sorry, I thought it was a vulnerability/technique impacting Google services that dropped at the convention. Now I get the connection was being made to widely reported staff behavior.
Re:Salesforce fires red team staffers who gave Defcon talk by coldtea on Thursday August 10, 2017 @06:29AM (#14978277)
In most corporations there's nothing like that.